How to restrict movement the ip telephone by branch offices customer?

[avelino01]

Hello,I would like to know if is possible restrict physical location ip telephony by branch offices, on client  we have 3 branch offices and I would like to restrict that any ip telephony doesnt work in another branch office. Because we have had movement of the ip telephony between localities and they work fine and with it we can not control the asset report.

Thank you in advance

[Jaime Valencia]

CUCM has no way to restrict access based on location/IP, you'll need to handle this at switch level using port security to tie a MAC address, or limit the number of MACs a port will accept.

[Georgios Fotiadis · Accepted solution]

One way to do it is have static entries for the IP phones on your DHCP servers; i.e. this way when a phone moves from one branch to other it will not be able to receive an IP address. Of-course users can by-pass the if the apply a static MAC address on the phone.

Another way would be to use "switchport port-security mac-address" that would restrict phone movement even inside a single branch.

Finally, you could utilize Device Mobility Groups and Geolocations (restricting calls when moving from one site to the other), but that would be the most "configuration intensive".

[avelino01]

Hello Georgios Fotiadis, thank you by information

How can I utilize Device Mobility Groups and Geolocations for restrict calls?

Could you give me any example configuration?

Thank you in advance

[Georgios Fotiadis]

You can start over here: https://supportforums.cisco.com/t5/ip-telephony/how-to-restrict-movement-the-ip-telephone-by-branch-offices/m-p/3231703#M354486

Just have in mind that you have to restrict calls while on mobility. Though, I am not sure that will totally serve you, concerning the configuration/maintenance overhead.

I would go with either of the other two options.

[avelino01]

I will use static entries for the ip phone on DHCP server, but first ,I tried to configure Device Mobility Groups and Geolocations, but it did not work. so I will try to use static because I think that easest to apply.

Thank you so much for help